Using Fluentd for store logs in ElasticSearch

Question

I have a Kubernetes cluster with 50+ pods on it, and I want to grab the logs from all of these pods, then store logs in the ElasticSearch and visualize that using Kibana, but ElasticSearch and Kibana should be outside Kubernetes, on another virtual machine in the same network.

How can I configure the Fluentd to grab and send logs to Non-Kubernetes ElasticSearch?

Answer 1

It is totally possible. In the kubernetes cluster, you would need to expose the Fluentd service on an external IP reachable from the virtual machine outside the cluster, and run ElasticSearch and Kibana on this virtual machine.

ElasticSearch (outside the kubernetes cluster) will access Fluentd (inside the kubernetes cluster) using the Fluentd service in k8s and pull the logs.

There are four ways to expose the Fluentd service in k8s for external access by ElasticSearch:

1. LoadBalancer service type which sets the ExternalIP automatically. This is used when there is an external non-k8s, cloud-provider's load-balancer like CGE, AWS or Azure, and this external load-balancer would provide the ExternalIP for the nginx ingress service.
2. ExternalIPs per https://kubernetes.io/docs/concepts/services-networking/service/#external-ips .
3. NodePort : In this approach, the service can be accessed from outside the cluster using NodeIP:NodePort/url/of/the/service.
4. Ingress : https://kubernetes.io/docs/concepts/services-networking/ingress/